Analysis

  • max time kernel
    42s
  • max time network
    45s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    23-11-2022 09:06

General

  • Target

    0080f77349daee5b7d5d9835408ad0380fbc11b982befdb95c7ef90f6f0a3bb1.exe

  • Size

    3.1MB

  • MD5

    fb044ebb44a937d699a7d7cd71e705ca

  • SHA1

    13b7960e547e52fb67a01893230ce362f860f063

  • SHA256

    0080f77349daee5b7d5d9835408ad0380fbc11b982befdb95c7ef90f6f0a3bb1

  • SHA512

    98b5a2b26aae88d85c7c74219e95196c189c11bcde36f088807dbc03be570f50c49dfcd5a3d7fac7ab027758c5bcddaf81c9331012f82e7cdfcae7fe2f4e5376

  • SSDEEP

    49152:4d+NgJ/rHVW9cwhw5bSTLj7TxNHIAy1h4atUQFKZ9AGj8Q35Mi1Z9oOs4f:4d+SxxSiyBywaSQFKF8Wg4f

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 9 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

Processes

  • C:\Users\Admin\AppData\Local\Temp\0080f77349daee5b7d5d9835408ad0380fbc11b982befdb95c7ef90f6f0a3bb1.exe
    "C:\Users\Admin\AppData\Local\Temp\0080f77349daee5b7d5d9835408ad0380fbc11b982befdb95c7ef90f6f0a3bb1.exe"
    1⤵
    • Loads dropped DLL
    PID:1788

Network

MITRE ATT&CK Matrix ATT&CK v6

Discovery

System Information Discovery

1
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\nsdEABF.tmp\Base64.dll
    Filesize

    4KB

    MD5

    f0e3845fefd227d7f1101850410ec849

    SHA1

    3067203fafd4237be0c186ddab7029dfcbdfb53e

    SHA256

    7c688940e73022bf526f07cc922a631a1b1db78a19439af6bafbff2a3b46d554

    SHA512

    584ae5a0d1c1639ba4e2187d0c8a0ac7e54c0be0a266029c4689d81c0c64a7f80e7d918da0df5c6344f9f7a114f30d8f2feda253b29e813bae086604731a3d8a

  • \Users\Admin\AppData\Local\Temp\nsdEABF.tmp\Base64.dll
    Filesize

    4KB

    MD5

    f0e3845fefd227d7f1101850410ec849

    SHA1

    3067203fafd4237be0c186ddab7029dfcbdfb53e

    SHA256

    7c688940e73022bf526f07cc922a631a1b1db78a19439af6bafbff2a3b46d554

    SHA512

    584ae5a0d1c1639ba4e2187d0c8a0ac7e54c0be0a266029c4689d81c0c64a7f80e7d918da0df5c6344f9f7a114f30d8f2feda253b29e813bae086604731a3d8a

  • \Users\Admin\AppData\Local\Temp\nsdEABF.tmp\Base64.dll
    Filesize

    4KB

    MD5

    f0e3845fefd227d7f1101850410ec849

    SHA1

    3067203fafd4237be0c186ddab7029dfcbdfb53e

    SHA256

    7c688940e73022bf526f07cc922a631a1b1db78a19439af6bafbff2a3b46d554

    SHA512

    584ae5a0d1c1639ba4e2187d0c8a0ac7e54c0be0a266029c4689d81c0c64a7f80e7d918da0df5c6344f9f7a114f30d8f2feda253b29e813bae086604731a3d8a

  • \Users\Admin\AppData\Local\Temp\nsdEABF.tmp\DialogEx.dll
    Filesize

    22KB

    MD5

    ec138e15734e89232ed5a0e5ee5944ec

    SHA1

    8ec0f8460f2ac604a22de1b2d531766c80000d04

    SHA256

    71a46c7173d9c25b9e918a75fa12582ac2404d1b76eb54b28009ac5b73acd3fa

    SHA512

    4084a5903c2c2a0c2246b11ae61f122939d2e5273f4be0cd97dad6ba70501323edf18b9be0b8cfde23a3e752a695daacf87a596334c87c3a7217239916bd8bc1

  • \Users\Admin\AppData\Local\Temp\nsdEABF.tmp\NSISdl.dll
    Filesize

    14KB

    MD5

    a5f8399a743ab7f9c88c645c35b1ebb5

    SHA1

    168f3c158913b0367bf79fa413357fbe97018191

    SHA256

    dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9

    SHA512

    824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977

  • \Users\Admin\AppData\Local\Temp\nsdEABF.tmp\NSISdl.dll
    Filesize

    14KB

    MD5

    a5f8399a743ab7f9c88c645c35b1ebb5

    SHA1

    168f3c158913b0367bf79fa413357fbe97018191

    SHA256

    dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9

    SHA512

    824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977

  • \Users\Admin\AppData\Local\Temp\nsdEABF.tmp\NSISdl.dll
    Filesize

    14KB

    MD5

    a5f8399a743ab7f9c88c645c35b1ebb5

    SHA1

    168f3c158913b0367bf79fa413357fbe97018191

    SHA256

    dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9

    SHA512

    824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977

  • \Users\Admin\AppData\Local\Temp\nsdEABF.tmp\NSISdl.dll
    Filesize

    14KB

    MD5

    a5f8399a743ab7f9c88c645c35b1ebb5

    SHA1

    168f3c158913b0367bf79fa413357fbe97018191

    SHA256

    dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9

    SHA512

    824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977

  • \Users\Admin\AppData\Local\Temp\nsdEABF.tmp\System.dll
    Filesize

    11KB

    MD5

    c17103ae9072a06da581dec998343fc1

    SHA1

    b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

    SHA256

    dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

    SHA512

    d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

  • memory/1788-54-0x0000000076321000-0x0000000076323000-memory.dmp
    Filesize

    8KB